CAPTCHA session reuse attack detected due to session deletion

Created on 18 November 2024, 15 days ago

In some cases we get a "CAPTCHA session reuse attack detected." in our logs. I suspect that this could i some cases be due to the fact that the user have spent a long time on the site before submitting the form. Eg. reading a lot of text first.

The standard setting for PHP session.gc_maxlifetime is 1440 seconds. Also the table holding the sessions "captcha_sessions" is purged via cron, where records older than session.gc_maxlifetime are deleted.

So if a user loads a page with captcha (we are using the Math captcha) and spends a lot of time on the page. Then decides to submit something it is possible that cron has already run, and deleted the users corresponding record with token information related to the captcha. The captcha module then responds with a "CAPTCHA session reuse attack detected." message.

The user has to spend more than 1440 secods on the page, but then this could happen.

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

🇳🇴Norway candalt

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024